Security: Authentication, Authorization, TLS, and Encryption
What this domain covers
Security: Authentication, Authorization, TLS, and Encryption tests your ability to enable authentication, apply least-privilege roles, secure cluster traffic, and protect data at rest.
Core rules
- Enable authorization with security.authorization: enabled in mongod.conf. Create the first admin user via the localhost exception before enabling auth, or use --auth after user creation.
- SCRAM-SHA-256 is the default password mechanism. Use x.509 or a keyfile for internal member authentication in replica sets and sharded clusters.
- Built-in roles include read, readWrite, dbAdmin, userAdmin, clusterAdmin, and root. Prefer scoped roles over root for applications.
- TLS settings include net.tls.mode, certificateKeyFile, CAFile, and allowConnectionsWithoutCertificates. Clients validate the server hostname against the certificate.
- Encryption at rest uses the Enterprise encrypted WiredTiger storage engine with KMIP or a local key manager. Client-side field-level encryption protects specific fields before they reach the server.
Worked example
An application needs read and write on the app database only. Create a user in the app database with readWrite, not root. Configure mongod with TLS required, a CA file, and a server certificate whose SAN matches the hostname. For replica set internal auth, use a keyfile with 600 permissions or x.509. The application connection string uses tls=true and the CA file.
Traps
Using root for applications; enabling auth before creating an admin user; forgetting keyfile permissions; hostname mismatch in TLS certificates; and assuming authentication alone grants least privilege.